Skip to content

chore(ci): bump the github-actions group with 6 updates - #1923

Merged
bdraco merged 1 commit into
masterfrom
dependabot/github_actions/github-actions-c5dde34de1
Oct 1, 2026
Merged

chore(ci): bump the github-actions group with 6 updates#1923
bdraco merged 1 commit into
masterfrom
dependabot/github_actions/github-actions-c5dde34de1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 6 updates:

Package From To
astral-sh/setup-uv 10.0.1 10.2.0
codecov/codecov-action 7.0.0 7.1.1
python-semantic-release/python-semantic-release 10.6.2 10.7.0
python-semantic-release/publish-action 10.6.2 10.7.0
docker/setup-qemu-action 4.2.0 4.4.0
pypa/cibuildwheel 4.2.0 4.2.1

Updates astral-sh/setup-uv from 10.0.1 to 10.2.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.2.0 🌈 Disable automatic cache saves for merge queues

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.1.0 🌈 New output python-runtime-idand respect NO_PROXY

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 for details on why this can be useful.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

... (truncated)

Commits

Updates codecov/codecov-action from 7.0.0 to 7.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

Commits

Updates python-semantic-release/python-semantic-release from 10.6.2 to 10.7.0

Release notes

Sourced from python-semantic-release/python-semantic-release's releases.

v10.7.0 (2026-09-22)

This release is published under the MIT License.

✨ Features

  • cmd-stamp: Expand version stamp mechanism to support typed python variables (PR#1485, 947c57b)

  • cmd-version: Add optional git --signoff to version commits (PR#1492, 3cecbeb)

📖 Documentation

  • configuration: Added signoff_commit setting definition (PR#1492, 3cecbeb)

  • configuration: Document Python type annotation support for version_variables (PR#1485, 947c57b)

⚙️ Build System

  • deps: Correct click range specification for python3.10+ (PR#1486, e4b3bad)

  • deps: Expand click dependency range to include v8.5.* (PR#1489, fa87c95)

💡 Additional Release Information

  • cmd-version: With this release, we added a boolean flag, semantic_release.signoff_commit, as an available configuration option to toggle the addition of the Signed-off-by git trailer/footer message to release commits made by Python Semantic Release. Default is currently set to False but if you want to try this option, set this configuration setting to True. In a future major release, this setting will be set to True by default.

✅ Resolved Issues

  • #1441: feat: add option to signoff commits made by python-semantic-release

  • #1443: feat: extend version_variables to replace vars with python type annotations

Detailed Changes: v10.6.2...v10.7.0

Installable artifacts are available from:

Changelog

Sourced from python-semantic-release/python-semantic-release's changelog.

.. _changelog:

========= CHANGELOG

.. _changelog-v10.7.0:

v10.7.0 (2026-09-22)

✨ Features

  • cmd-stamp: Expand version stamp mechanism to support typed python variables, closes [#1443](https://github.com/python-semantic-release/python-semantic-release/issues/1443)_ (PR#1485, 947c57b)

  • cmd-version: Add optional git --signoff to version commits, closes [#1441](https://github.com/python-semantic-release/python-semantic-release/issues/1441)_ (PR#1492, 3cecbeb)

📖 Documentation

  • configuration: Added signoff_commit setting definition (PR#1492, 3cecbeb)

  • configuration: Document Python type annotation support for version_variables (PR#1485, 947c57b)

⚙️ Build System

  • deps: Correct click range specification for python3.10+ (PR#1486, e4b3bad)

  • deps: Expand click dependency range to include v8.5.* (PR#1489, fa87c95)

💡 Additional Release Information

  • cmd-version: With this release, we added a boolean flag, semantic_release.signoff_commit, as an available configuration option to toggle the addition of the Signed-off-by git trailer/footer message to release commits made by Python Semantic Release. Default is currently set to False but if you want to try this option, set this configuration setting to True. In a future major release, this setting will be set to True by default.

.. _#1441: python-semantic-release/python-semantic-release#1441 .. _#1443: python-semantic-release/python-semantic-release#1443 .. _3cecbeb: python-semantic-release/python-semantic-release@3cecbeb .. _947c57b: python-semantic-release/python-semantic-release@947c57b .. _e4b3bad: python-semantic-release/python-semantic-release@e4b3bad .. _fa87c95: python-semantic-release/python-semantic-release@fa87c95

... (truncated)

Commits
  • b700dbe chore: release v10.7.0
  • 3cecbeb feat(cmd-version): add optional git --signoff to version commits (#1492)
  • 0f4d414 build(deps-dev): expand filelock compatibility range to include v4.0+ (#1...
  • 35f7674 ci(deps): bump docker/build-push-action@v7.3.0 to v7.4.0 (#1495)
  • fa87c95 build(deps): expand click dependency range to include v8.5.* (#1489)
  • 4e78311 test(fixtures): adjust git monorepo creation fixtures to prevent race conditi...
  • 1d56d3a test(cmd-version): refactor imports to new flatdict variant
  • 1c48576 build(deps-test): swap broken flatdict with cj365-flatdict variant
  • f77ed51 ci(deps): bump mikepenz/action-junit-report@v6.4.2 to v6.5.0 (#1484)
  • 086cf14 test(fixtures): adjust git repo creation fixtures to prevent race conditions ...
  • Additional commits viewable in compare view

Updates python-semantic-release/publish-action from 10.6.2 to 10.7.0

Release notes

Sourced from python-semantic-release/publish-action's releases.

v10.7.0 (2026-09-22)

Build System

  • deps: Bump python-semantic-release from 10.6.2 to 10.7.0 (#111, 99d4062)

Detailed Changes: v10.6.2...v10.7.0

Commits
  • 99d4062 build(deps): bump python-semantic-release from 10.6.2 to 10.7.0 (#111)
  • 81b4773 ci(deps): bump python-semantic-release@v10.6.2 action to v10.7.0 (#112)
  • 9c35d91 ci(deps): bump docker/build-push-action@v7.3.0 to v7.4.0 (#110)
  • See full diff in compare view

Updates docker/setup-qemu-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.4.0

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

v4.3.0

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

Commits
  • 9901266 Merge pull request #342 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
  • 9364d8b Merge pull request #340 from docker/dependabot/npm_and_yarn/humanfs/node-0.16.8
  • 95c3240 Merge pull request #337 from docker/dependabot/npm_and_yarn/postcss-selector-...
  • c24671a Merge pull request #338 from docker/dependabot/github_actions/codeql-actions-...
  • fa83965 Merge pull request #345 from crazy-max/shared-error-helpers
  • f396a65 build(deps): bump the codeql-actions group across 1 directory with 2 updates
  • a63df2f chore: update generated content
  • 3e4165f use the shared error helper for Docker commands
  • 18c52d9 Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 896cbed [dependabot skip] chore: update generated content
  • Additional commits viewable in compare view

Updates pypa/cibuildwheel from 4.2.0 to 4.2.1

Release notes

Sourced from pypa/cibuildwheel's releases.

v4.2.1

  • 🐛 Respects the NuGet package sources configured on the machine when installing CPython on Windows, instead of always falling back to nuget.org (#2966)
  • 🐛 Fixes a NameError on Pyodide when an already-compatible wheel was reused, which made the test step fail (#2968)
  • 🛠 Updates the Android Python versions, and the Android testbed's Gradle version, making it compatible with Java 25 (#2962)
  • 🛠 Updates dependencies including CPython 3.15.0rc2 (#2965, #2970, #2976, #2981, #2985)
Changelog

Sourced from pypa/cibuildwheel's changelog.

title: Changelog ref: changelog

Changelog

v4.2.1

5 September 2026

  • 🐛 Respects the NuGet package sources configured on the machine when installing CPython on Windows, instead of always falling back to nuget.org (#2966)
  • 🐛 Fixes a NameError on Pyodide when an already-compatible wheel was reused, which made the test step fail (#2968)
  • 🛠 Updates the Android Python versions, and the Android testbed's Gradle version, making it compatible with Java 25 (#2962)
  • 🛠 Updates dependencies including CPython 3.15.0rc2 (#2965, #2970, #2976, #2981, #2985)

v4.2.0

4 August 2026

  • 🌟 CPython 3.15 wheels are now built by default - without the "cpython-prerelease" enable set. It's time to build and upload these wheels to PyPI! This release includes CPython 3.15.0rc1, which is guaranteed to be ABI compatible with the final release. (#2944)
  • ✨ Adds Pyodide 3.15 support with the cp315-pyodide_wasm32 build identifier, using Pyodide 315.0.0a2. These are also stable wrt. the final release. (#2958)
  • 🐛 Retries a failed download six times with exponential backoff, so short network outages no longer stop a build. A 4xx response is still reported at once. (#2953)
  • 🐛 Accepts default as a build-frontend value on Pyodide, and accepts pyodide-build in the top-level table and in overrides (#2951)
  • 🛠 Holds pip back on GraalPy, where newer pip breaks the build (#2955)
  • 🛠 Updates Pyodide to 314.0.4 (#2949, #2952)
  • 🛠 Updates dependencies and container pins (#2952, #2960)
  • 💼 Updates CI action pins (#2948, #2954)
  • 🧪 Uses pp311 for the abi3 test, and deletes test_overridden_pip_constraint, which is not necessary since #2583 (#2956, #2957)

v4.1.1

24 July 2026

  • ✨ Adds pyodide-build as a separate build-frontend, now the default frontend for Pyodide, with verbosity flags handling. Any other frontend is ignored with a warning on Pyodide. (#2609, #2945)
  • 🔐 Uses digests instead of tags for pinned container images, strengthening supply-chain security. The human-readable tags remain as comments in pinned_docker_images.cfg. (#2915)
  • 🐛 Fixes platform-specific test-runtime environment variables (e.g. CIBW_TEST_RUNTIME_ANDROID) not being honored (#2941)
  • 🐛 Fixes quoting of test-requires and audit-requires so PEP 508 specifiers containing spaces work (#2913)
  • 🐛 Makes archs parsing case-insensitive and platform-aware, so e.g. arm64 works on Windows (#2920)
  • 🐛 Uses an absolute path for the {project} placeholder in config-settings (#2934)
  • 🐛 Validates the pyodide-version option against the build identifier with a clear error (#2925)
  • 🐛 Fixes PyPy installs on macOS after PyPy switched its downloads from .tar.bz2 to .tar.gz (#2939)
  • 🐛 Makes a matching python3-config available in the build and test venvs on macOS (#2922)
  • 🛠 Updates dependencies and container pins (#2917, #2935, #2939)
  • 🛠 Updates Android tests to current Python versions and the new test repository URL (#2933)
  • 🛠 Drops the orjson dependency, no longer used by mypy 2+ (#2923)
  • 📚 Builds the docs with properdocs, a MkDocs fork (#2946)
  • 📚 Adds the missing cp314-pyodide_wasm32 entry to the build identifier table (#2947)
  • 📚 Removes outdated notes about the pip wheel build frontend and ClearLinux (#2926)
  • 💼 Adds a "CI: PyPy EoL" PR label to run PyPy EoL tests on PRs (#2930)

... (truncated)

Commits
  • e090b81 Bump version: v4.2.1
  • 59501f4 Respect configured NuGet package sources (#2966)
  • 885ead0 [Bot] Update dependencies (#2985)
  • 3d9e8c5 docs: refresh CircleCI and CPython platform links (#2977)
  • 7d5ec95 [Bot] Update dependencies (#2981)
  • a007eed [Bot] Update dependencies (#2976)
  • fdda545 chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the actions grou...
  • 8832cf6 chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 in the ...
  • a35209b [Bot] Update dependencies (#2970)
  • 148ea70 chore: faster and stricter mypy (#2968)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(ci): bump the github-actions group with 6 updates
bf2f272 
Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.0.1` | `10.2.0` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `7.0.0` | `7.1.1` |
| [python-semantic-release/python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) | `10.6.2` | `10.7.0` |
| [python-semantic-release/publish-action](https://github.com/python-semantic-release/publish-action) | `10.6.2` | `10.7.0` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.2.0` | `4.4.0` |
| [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) | `4.2.0` | `4.2.1` |


Updates `astral-sh/setup-uv` from 10.0.1 to 10.2.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@20cfd1b...c18668a)

Updates `codecov/codecov-action` from 7.0.0 to 7.1.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@fb8b358...303a32d)

Updates `python-semantic-release/python-semantic-release` from 10.6.2 to 10.7.0
- [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases)
- [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.rst)
- [Commits](python-semantic-release/python-semantic-release@9a026e9...b700dbe)

Updates `python-semantic-release/publish-action` from 10.6.2 to 10.7.0
- [Release notes](https://github.com/python-semantic-release/publish-action/releases)
- [Changelog](https://github.com/python-semantic-release/publish-action/blob/main/releaserc.toml)
- [Commits](python-semantic-release/publish-action@6d89e2d...99d4062)

Updates `docker/setup-qemu-action` from 4.2.0 to 4.4.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@96fe6ef...9901266)

Updates `pypa/cibuildwheel` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/pypa/cibuildwheel/releases)
- [Changelog](https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md)
- [Commits](pypa/cibuildwheel@1828c10...e090b81)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: python-semantic-release/python-semantic-release
  dependency-version: 10.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: python-semantic-release/publish-action
  dependency-version: 10.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: pypa/cibuildwheel
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 1, 2026
@codspeed

codspeed Bot commented Oct 1, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 24 untouched benchmarks

Comparing dependabot/github_actions/github-actions-c5dde34de1 (bf2f272) with master (1d939f4)1

Open in CodSpeed

Footnotes

  1. No successful run was found on master (f8b9ac5) during the generation of this report, so 1d939f4 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

@codecov

codecov Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.87%. Comparing base (1d939f4) to head (bf2f272).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master    #1923   +/-   ##
=======================================
  Coverage   99.87%   99.87%           
=======================================
  Files          33       33           
  Lines        3913     3913           
  Branches      568      568           
=======================================
  Hits         3908     3908           
  Misses          3        3           
  Partials        2        2

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@bdraco
bdraco merged commit f0c27b3 into master Oct 1, 2026
41 checks passed
@bdraco
bdraco deleted the dependabot/github_actions/github-actions-c5dde34de1 branch October 1, 2026 11:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bdraco bdraco bdraco approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bdraco